3Com LANPLEX 2500, Operation Manual

Page: 63 / 139

7-6 C
HAPTER
7: U
SER
-
DEFINED
P
ACKET
F
ILTERING
Example 2: Filtering AppleTalk Phase II Packets
If your Macintosh computers use the AppleTalk Phase II protocol instead of
the AppleTalk Phase I protocol (as shown in Example 1), then you must use
a filter slightly more complicated.
AppleTalk Phase II uses 802.3 protocol instead of Ethernet as the physical
layer protocol. Ethernet and 802.3 packets are distinguished using the
2-byte field at offset 12 in the packet. The filter must first ensure that the
packet is an 802.3 packet. If that field is:
■
Greater than 1500, then the packet is an Ethernet packet and the value is
interpreted as the type field.
■
Less than or equal to 1500, then the packet is an 802.3 packet and the value
is interpreted as the data length.
In an AppleTalk Phase II packet, a Subnetwork Access Protocol (SNAP)
“header” follows the 802.3 header. See Figure 7-4. The filter must verify that
the contents of this SNAP field match the AppleTalk packet’s
SNAP field.
Figure 7-4 AppleTalk Phase II Packet Fields
The filter definition for filtering AppleTalk Phase II packets is:
if (type field <= 1500) AND (SNAP = 0x03080007809b) then discard
packet
Destination
address
Source
address
LLC
data
Length
0 6 12 14 25
AppleTalk
®
Phase II Packet
SNAP header = AAAA03080007809b
16 22